General
-
Target
Ref 2998390020 purchasing inquiry.rar
-
Size
380KB
-
Sample
211003-l1hvwsfcfm
-
MD5
ba9a50644b51032318fba8b4feece352
-
SHA1
f1ec4b3f9a65726f15681235b5a52b6d82b5c46e
-
SHA256
591b179d161ffb99cf404c3c2a2ef5ed93452dd737c6c91bc3182838961fa295
-
SHA512
a9b0ca29cf809d4e849f35ec1ab54fc17263230c3fb34ca42f22ffa66e222c4e4a382506ed26bc905fccda27213a5821729b6dca08565b62335ad2e2bf3de6ea
Static task
static1
Behavioral task
behavioral1
Sample
Ref 2998390020 purchasing inquiry.exe
Resource
win7-en-20210920
Malware Config
Extracted
matiex
Protocol: smtp- Host:
mail.thts.vn - Port:
25 - Username:
[email protected] - Password:
123luongngan1989
Extracted
Protocol: smtp- Host:
mail.thts.vn - Port:
25 - Username:
[email protected] - Password:
123luongngan1989
Targets
-
-
Target
Ref 2998390020 purchasing inquiry.exe
-
Size
442KB
-
MD5
4db15735772716ead8b0a838c67f91c6
-
SHA1
e7770b8a8d3d092f3bd38de265890f6cf17d1406
-
SHA256
5d65c8c1dbe91d020fe6dfefe37ef17651aaead257fdd7f24aa08b9a38cbb8fc
-
SHA512
38f0d118a3dfdb2ca0a0fd64b23cde9cdd76c410b85fa1f69dd164b121a25c213ea5dff75a7ab658c57cd5b7822cc16f7e19bcdeb63d202271065147cb22cc4c
-
Matiex Main Payload
-
Drops startup file
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-